Cheat Engine

fmwyso · Posted: Tue Oct 19, 2010 4:29 pm Post subject: Packet Decrypting

Hi, I recently figured out a way to listen to packets on a game. Unfortunately, I have no idea how to remove gameguard and I can't find any gameguard mod files for it. So, because of that, I've decided to create my own program seeing as how it instantly shuts down as soon as CEG or WPE is open.

http://www.codeproject.com/KB/winsdk/Sniffer.aspx

Nearly every part of my code is directly from this example... I used his program to detect the messages sent/received by the game and, from what I saw, it only used TCP. Now, I have written the base for my program which simply is able to just tell me every time the game sends/receives a command. It can tell me the ip, ack number, sequence number, and various other information which I believe has little to do with the actual data being sent. Hopefully, I want to be able to actually know exactly what was sent (Such as "use skill 520" or "Move to 500,200,300") etc.

First of all, please tell me if this code is even able to do such a thing as actually grab the data from the packets. I know it can sniff out the ip/etc., but does it also have access to the data that is sent?

1) Are there any guides for finding data in packets? Hopefully highlighting most common placement of values for tcp packets.

2) I know that many games have packet encryption, is there a tutorial on how to find that encryption? After I find the encryption, I'm sure I can google some type of library to decrypt it.

3) After I find the data and decrypt it, is there a tutorial/guide on finding out how they sequence their data? As in, the first 2 bytes are the id, next 2 are the command etc.

atom0s · Posted: Tue Oct 19, 2010 4:58 pm Post subject:

In most cases for any game that implements any of your questions, the quote "To each their own." fits fairly well. You will almost never find two similar implemented systems between games, (Unless its the same engine/same developer/etc.) which leaves tutorial writing for an 'overall' status fairly hard to do since the methods of finding things will vary.

One common method you can use to find encryption methods would be to locate where send/recv are called from in the game, and trace back the calls and follow the flow of code. In most cases the game will have some method / order of doing something like:

Encryption:
Build Packet -> Encrypt Packet -> Send to Client(s)

Decryption:
Receive Packet -> Decrypt Packet -> Read Packet Header / Handle Packet

Again the order of this can change per-game based on the developers depth with coding and security.

SwaggaJackin' · Posted: Tue Oct 19, 2010 7:57 pm Post subject:

Have you considered using wireshark? It'd be a great alternative to writing your own packet sniffer.

fmwyso · Posted: Tue Oct 19, 2010 8:43 pm Post subject:

atom0s · Posted: Wed Oct 20, 2010 10:08 am Post subject:

You just need to find whats causing it to be detected. You can use a debugger such as Ollydbg and get some plugins such as OllyAdvanced to attempt to hide it with some basic methods, or look around for some customized versions of Olly which are fully altered to be hidden from most known detection methods.

Typically a few basic methods are used to detect a debugger:
- Process name, window names.
- IsDebuggerPresent() API
- CheckRemoteDebuggerPresent() API

There are a bunch of different plugins to handle these above methods, there are plenty of other detection methods as well so you may need to do some digging to find exactly what causes it.

If you need to find some tutorials, plugins, and/or info for Olly I'd recommend going to:
http://tuts4you.org